CVE-2026-15406: WordPress Eventin Plugin RCE Vulnerability

CVE-2026-15406 Overview

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress contains a Local File Inclusion (LFI) vulnerability. The flaw affects all versions up to and including 4.1.22 through the event_layout parameter. Authenticated attackers with custom-level access or higher can include and execute arbitrary .php files on the server. Successful exploitation allows attackers to bypass access controls, obtain sensitive data, or achieve arbitrary code execution when combined with file upload capabilities. The vulnerability is tracked under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Authenticated attackers can execute arbitrary PHP code on affected WordPress installations, potentially leading to full site compromise.

Affected Products

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress
All versions up to and including 4.1.22
WordPress installations with custom-level user roles enabled

Discovery Timeline

2026-09-09 - CVE CVE-2026-15406 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-15406

Vulnerability Analysis

The vulnerability resides in the Eventin plugin's event template rendering logic. The event_layout parameter passed to the plugin's event controller endpoints is used to construct a file path that is subsequently included via a PHP include or require statement. Because the parameter is not properly validated or restricted to an allowlist of permitted template files, attackers can supply values that traverse the filesystem and load arbitrary .php files present on the server.

Attackers who can upload .php files through other vectors, such as media handlers or plugin misconfigurations, can chain those uploads with this inclusion flaw to achieve remote code execution. The referenced source lines in EventController.php and template-functions.php for versions 4.1.15 and 4.1.16 demonstrate where the untrusted parameter reaches the file-inclusion sink.

Root Cause

The root cause is improper control of a filename used in a PHP include statement, classified as [CWE-98]. The event_layout value flows from a REST or AJAX request into the template loader without sanitization, path normalization, or validation against a fixed set of permitted layout identifiers. Access is gated only by a custom-level permission check, which is broadly available in many WordPress deployments.

Attack Vector

The attack requires network access to the WordPress site and an authenticated account with custom-level access or higher. The attacker sends a request to the vulnerable event controller endpoint, supplying a crafted event_layout value that resolves to an arbitrary .php file path on the server. The included file executes with the privileges of the PHP process serving WordPress. See the Wordfence Vulnerability Analysis for additional technical context.

No verified proof-of-concept code has been published. Refer to the WordPress EventController API Code and WordPress Event Template Functions Code for the vulnerable code paths.

Detection Methods for CVE-2026-15406

Indicators of Compromise

HTTP requests to Eventin REST or AJAX endpoints containing event_layout parameter values with path traversal sequences such as ../ or absolute filesystem paths.
Unexpected PHP file inclusions in web server or PHP error logs referencing files outside the plugin's template directory.
New or modified .php files in WordPress upload directories wp-content/uploads/ correlated with authenticated plugin requests.
Outbound network connections initiated by the PHP process following requests to Eventin endpoints.

Detection Strategies

Inspect web access logs for requests to Eventin controller routes containing suspicious event_layout values that reference paths outside wp-content/plugins/wp-event-solution/.
Monitor PHP include/require activity and file access patterns from the WordPress process for reads of files not associated with the plugin.
Alert on newly created custom-role accounts followed shortly by requests to Eventin API endpoints.

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule set that flags path traversal patterns in POST and GET parameters targeting /wp-json/ and admin-ajax.php.
Track authenticated session activity for accounts with custom-level access, particularly those interacting with plugin APIs.
Correlate WordPress audit logs with filesystem change monitoring on the wp-content/ directory tree.

How to Mitigate CVE-2026-15406

Immediate Actions Required

Update the Eventin plugin to a version later than 4.1.22 that addresses this issue as soon as the vendor publishes a fix.
Audit all WordPress user accounts and remove or downgrade custom-level roles that are not strictly required.
Review web server and PHP logs for prior exploitation attempts against Eventin endpoints referencing the event_layout parameter.
Inspect wp-content/uploads/ and other writable directories for unauthorized .php files.

Patch Information

Review the WordPress Event Solution Changeset and the Wordfence Vulnerability Analysis for the latest patch status. Apply the vendor update through the WordPress plugin management console once available.

Workarounds

Disable or uninstall the Eventin plugin until a patched version is available if the plugin is not business-critical.
Restrict access to Eventin REST and AJAX endpoints at the WAF or reverse proxy layer to trusted IP addresses.
Configure PHP open_basedir to constrain file inclusion to the WordPress installation directory, limiting the impact of arbitrary path inclusion.
Enforce strict file upload validation to prevent .php files from being written to web-accessible locations.

bash

# Configuration example: restrict PHP file inclusion scope via open_basedir
# Add to php.ini or a per-site php-fpm pool configuration
open_basedir = "/var/www/html/:/tmp/"

# Deny execution of PHP files inside uploads directory (Apache .htaccess)
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.php$">
    Require all denied
</FilesMatch>